Field of the Invention
This invention relates generally to the field of data processing systems. More particularly, the invention relates to a system and method for integrating an authentication service within a network architecture.
Description of Related Art
Systems have also been designed for providing secure user authentication over a network using biometric sensors. In such systems, the a score generated by an authenticator, and/or other authentication data, may be sent over a network to authenticate the user with a remote server. For example, Patent Application No. 2011/0082801 (“'801 Application”) describes a framework for user registration and authentication on a network which provides strong authentication (e.g., protection against identity theft and phishing), secure transactions (e.g., protection against “malware in the browser” and “man in the middle” attacks for transactions), and enrollment/management of client authentication tokens (e.g., fingerprint readers, facial recognition devices, smartcards, trusted platform modules, etc).
The assignee of the present application has developed a variety of improvements to the authentication framework described in the '801 application. Some of these improvements are described in the following set of US Patent Applications, which are assigned to the present assignee: Ser. No. 13/730,761, Query System and Method to Determine Authentication Capabilities; Ser. No. 13/730,776, System and Method for Efficiently Enrolling, Registering, and Authenticating With Multiple Authentication Devices; Ser. No. 13/730,780, System and Method for Processing Random Challenges Within an Authentication Framework; Ser. No. 13/730,791, System and Method for Implementing Privacy Classes Within an Authentication Framework; Ser. No. 13/730,795, System and Method for Implementing Transaction Signaling Within an Authentication Framework; and Ser. No. 14/218,504, Advanced Authentication Techniques and Applications (hereinafter “'504 Application”). These applications are sometimes referred to herein as the (“Co-pending Applications”).
Briefly, the Co-Pending applications describe authentication techniques in which a user enrolls with authentication devices (or Authenticators) such as biometric devices (e.g., fingerprint sensors) on a client device. When a user enrolls with a biometric device, biometric reference data is captured (e.g., by swiping a finger, snapping a picture, recording a voice, etc). The user may subsequently register/provision the authentication devices with one or more servers over a network (e.g., Websites or other relying parties equipped with secure transaction/authentication services as described in the Co-Pending Applications); and subsequently authenticate with those servers using data exchanged during the registration process (e.g., cryptographic keys provisioned into the authentication devices). Once authenticated, the user is permitted to perform one or more online transactions with a Website or other relying party. In the framework described in the Co-Pending Applications, sensitive information such as fingerprint data and other data which can be used to uniquely identify the user, may be retained locally on the user's authentication device to protect a user's privacy.
The '504 Application describes a variety of additional techniques including techniques for designing composite authenticators, intelligently generating authentication assurance levels, using non-intrusive user verification, transferring authentication data to new authentication devices, augmenting authentication data with client risk data, and adaptively applying authentication policies, and creating trust circles, to name just a few.
Augmenting a Relying Party's web-based or other network enabled application to leverage the remote authentication techniques described in the co-pending applications typically requires the application to integrate directly with an authentication server. This poses a barrier to the adoption of such authentication, as Relying Parties will need to expend effort to update their applications to integrate with an authentication server in order to gain the authentication flexibility provided by the techniques described in the co-pending applications.
In some cases, the Relying Party may have already integrated with federation solutions, and thus a simple integration path is to simply integrate online authentication support into the federation solution. Unfortunately, this approach does not address other legacy systems (such as VPNs, Windows Kerberos deployments) that either lack awareness of federation protocols (and thus could be front-ended by a federation server augmented with online authentication functionality), or lack sufficient extensibility to enable direct integration of online authentication functionality. Hence, a key problem that must be solved for certain Relying Party applications is finding a way to enable them to integrate online authentication systems, without requiring the code for the applications themselves to be modified.